Another day, another data compliance to wrap our heads around. This time, uncover the basics of FERPA, who it protects, why you should care… and everything in between.
FERPA – The Champion of Students
FERPA… aren’t those the local guys on Mt. Everest, carrying all the rich “mountaineers’” equipment to the top and back, with no oxygen tank or fancy North Face jackets?
No, you might be thinking of ‘Sherpa,’ but FERPA actually presents its own mountain of sorts—not one of snow and incredible views but rather compliance-related guidelines enforced by US Federal Law.
Unlike many of the other privacy and data-protecting directives we’ve discussed in the past, The Family Educational Rights and Privacy Act (commonly known as “FERPA”) was first introduced all the way back in 1974!
Sometimes also called the Buckley Amendment (named after one of its main proponents, Senator James L. Buckley), FERPA was established to protect the privacy of student education records.
In short, this federal law applies to students throughout their entire educational lifespan, starting in kindergarten, through high school, and even after college and other learning programs. FERPA ensures that these students’ information remains safe and nondisclosed to anyone but them or their parents, effectively providing students the rights over their education records.
But that’s not all. FERPA also affects career services professionals, making it a crucial law for anyone in the industry who helps students find networking opportunities, provides mentorships, and offers counsel.
A Deeper Look
You may think: “A law passed in the 1970s? Did they even have computers when this thing was passed?” Those are understandable concerns, and while FERPA may be old, it certainly isn’t outdated. Whether students’ PII is stored in physical or digital files, the same rules still apply. So, let’s take a closer look at exactly how this regulation works.
FERPA was designed to increase the safety of student records and empower parents and students to leverage their rights. So far, FERPA has impacted the educational system tremendously, especially regarding authorized access to student records.
As mentioned above, FERPA only allows for two basic authorized accessors:
- the students,
- and their parents.
That seems pretty straightforward, but just to be certain, FERPA also has its own definition of a student. The Family Educational Rights and Privacy Act sees students as any individual who regularly attends classes at any educational institution, physically, by correspondence, or from anywhere. And in 2024, that includes online students attending classes via video conferencing or similar modern tools. Contrarily, an individual admitted to a specific school but not attending classes isn’t protected under this act.But the real meat and potatoes is this: Under FERPA, the federal law clearly prohibits the disclosure of students’ personal information or data to any third party, notwithstanding the medium used to transmit them, such as electronically, handwritten, or by mail.
Information Protected Under FERPA Law
We all like meat and potatoes (except our vegetarian friends), so let’s go a bit further into what exactly FERPA is set to protect. As already established, FERPA was created to secure students’ data, and this information can be divided into two basic categories:
Personally Identifiable Information (PII)
PII is pretty self-explanatory; basically, any personal information that could be used to identify a student. Think of Social Security numbers, biometric data, bank account numbers, etc. Check out our Complete Guide to PII if you want to know more. Students’ PII must be protected and can’t be shared.
Directory Information
On the other hand, directory information relates to any kind of education data whose disclosure may not be harmful or invasive to a student’s privacy. It’s important to know that disclosing directory information IS NOT prohibited. So, an institution can disclose to a third party even without getting permission from the student or parent.
Directory information includes data such as a student’s name, phone number, or home address. However, to disclose directory information to a third party, an educational institution must send a two-day notice to the parents or students, telling them why the info is being disclosed and to whom.
Achieving FERPA Compliance
Failing to abide by FERPA is no joke. Institutions can be fined over seven figures as well as lose their much-needed federal funding. These factors often lead to a decrease in that school’s overall performance and attractiveness to students.
But fines and penalties should never be the driving motive for compliance. The most important reason for such institutions and the aforementioned career service professionals to become FERPA compliant is simply to protect the students.
Everyone has a right to their own privacy. By following FERPA, any organization can become compliant, leaving their students to focus on more important things, like their education and trying to build a better tomorrow.
Can’t Find It, Can’t Protect It. Use PII-Tools Data Discovery Software to Locate and Protect FERPA Data Today!
